Privacy Policy

DRAFT: for legal review before launch. Placeholders in [square brackets] must be completed by the operator.

Disputex Pty Ltd, ABN 81 699 300 260 ("we", "us") runs Couch Call. We're bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we handle your personal information. We collect as little as we can and keep it for as short a time as we can.

1. What we collect

Information	Why	How it's protected
Email address	To sign you in with a one-time link, and to send account and voucher emails	Stored encrypted; looked up only through a one-way keyed hash
Username (generated for you at sign-up) and avatar style	Shown on leaderboards and in rooms	Public within the app
18+ confirmation (yes/no and when)	We're an adults-only service
Predictions, scores, streaks, ratings	To run the game and leaderboards
Chat messages	To show them in episode rooms and watch-along rooms	Deleted 48 hours after an episode room opens; a watch-along's chat is deleted when that room closes (a few hours at most)
Moderation records	To keep rooms safe and act on repeat abuse	We keep only a hash of the message, never the text, for 90 days
Reports and blocks	To protect you and others
Device and usage data: browser/app type, sign-in sessions, a device identifier	Security, keeping you signed in, preventing duplicate accounts and reward fraud	The device identifier is stored only as a keyed hash; it can't be turned back into the original
Push notification token (if you turn reminders on)	To send episode reminders and results	Deleted when you turn reminders off
Usage analytics (screens opened, features used)	To improve the app	Only if you agree; see section 5
Reward redemptions	To deliver vouchers and enforce caps

We don't collect your name, phone number, date of birth, contacts, photos or precise location. In this version we don't use your IP address to work out your location. IP addresses are used briefly, in hashed form, only to limit abuse (rate limiting) and are not stored with your account.

2. How we collect it

Directly from you when you sign up and use the app, and automatically from your device as you use it. We don't buy personal information about you from anyone.

By creating an account you consent to us handling your information as described here. Analytics and marketing emails are separate, optional choices. They're off unless you turn them on, and you can change your mind at any time in You › Settings.

4. How long we keep it

Chat messages: hard-deleted 48 hours after the episode room opens. Watch-along rooms (public or private rooms players start to watch together later) delete their chat when the room closes. For private rooms we also keep who is a member until the room closes; invite links are stored hashed.
Moderation logs: message hashes only, kept for 90 days.
Sign-in links: expire after 15 minutes; used and expired links are deleted.
Sign-in sessions: up to 30 days unless you sign out (signing out ends them immediately).
Account data (username, predictions, scores, redemptions): until you delete your account.
Records we must keep by law (for example, if we're required to keep evidence of a serious incident): only as long as the law requires.

5. Cookies and analytics

We use essential cookies to keep you signed in and secure (they're httpOnly and can't be read by scripts). These can't be switched off while you use the app.
Analytics are off until you say yes. When you first visit we ask; if you decline, we don't record usage analytics about you. You can change this in You › Settings.
We do not use cross-site tracking, advertising cookies or tracking pixels, and we don't sell personal information.

We use service providers to run Couch Call. They may handle your information on our behalf, under contract, only to provide their service:

Hosting and database: [HOSTING PROVIDER]
Email delivery: [EMAIL PROVIDER]
Push notifications: [PUSH PROVIDER] (and Apple/Google push services if you use the mobile app)
Content moderation: [MODERATION PROVIDER] (message text is sent for automated checking; it isn't kept by us beyond the 48-hour window)
Analytics (only with your consent): [ANALYTICS PROVIDER]
Reward fulfilment: if we use a gift card provider ([GIFT CARD PROVIDER]) to issue a voucher you redeem, it receives only what's needed to deliver it (your email address). Retailers named on vouchers receive nothing from us.
Advertising or affiliate partners: [PARTNERS, IF ANY. None in this version]

We may also disclose information if required or authorised by law, or to protect someone's safety.

7. Overseas disclosure

Some of our providers may store or process information outside Australia, including in [COUNTRIES]. We take reasonable steps to make sure they handle it consistently with the APPs.

8. Marketing

We'll only send you marketing emails if you opt in (the box is unticked by default). Every email we send identifies us and includes an unsubscribe link, in line with the Spam Act 2003 (Cth). Unsubscribing takes effect immediately. Account emails, such as sign-in links and voucher delivery, aren't marketing.

9. Access, correction and deletion

You can see your username in the app (it's generated for you and can't be changed there), and change your notification, analytics and marketing settings.
You can delete your account at any time at /settings/delete. It's immediate and signs you out everywhere.
To ask for a copy of your information, or to correct it, contact our privacy officer (below). We'll respond within 30 days.

10. Security and data breaches

We protect information with encryption in transit (HTTPS) and at rest for sensitive fields, short-lived sign-in tokens, access controls and monitoring. If a data breach is likely to result in serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches (NDB) scheme.

11. Children

Couch Call is not for anyone under 18. We don't knowingly collect information from children. If we learn an account belongs to someone under 18, we delete it.

12. Complaints

If you have a privacy concern, contact our privacy officer first and we'll respond within 30 days. If you're not satisfied, you can complain to the OAIC: www.oaic.gov.au, phone 1300 363 992.

13. Contact our privacy officer

Privacy Officer, Disputex Pty Ltd
[STREET ADDRESS], [SUBURB] NSW [POSTCODE], Australia
Email: privacy@couchcall.com.au